*************************************************************** *************************************************************** 55 file changed, 923 insertions(+), 155 deletions(-) *************************************************************** *************************************************************** ========platform/bionic between android-7.1.2_r17..android-7.1.2_r27========= linker/linker.cpp | 3 +++ 1 file changed, 3 insertions(+) 0b1283172 linker: remove link from external library on unload ========platform/build between android-7.1.2_r17..android-7.1.2_r27========= core/build_id.mk | 2 +- core/version_defaults.mk | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) b621610d7 Version bump to NZH54B 468971e79 [DO NOT MERGE]Updating security string to 2017-07-05 on nyc-dev bug:38342695 (cherry picked from commit 96d958c34509a65e5f7787945f9923fb44c42f05) 46fb9aeb7 [DO NOT MERGE]Updating security string to 2017-07-01 on nyc-dev bug:38342695 (cherry picked from commit 77dad3dfcd677136f6657e1b95dd84ed1be1d728) 38c126f7b NZH34C ========device/asus/fugu-kernel between android-7.1.2_r17..android-7.1.2_r27========= bzImage | Bin 5388176 -> 5388736 bytes 1 file changed, 0 insertions(+), 0 deletions(-) 24344f3 release-request-762540b1-1728-41bc-a9ce-e977f3e2683f-for-git_nyc-mr2-pixel-monthly-release-3888830 snap-temp-L22300000056915770 ========device/google/dragon-kernel between android-7.1.2_r17..android-7.1.2_r27========= Image.fit | Bin 7776256 -> 7777108 bytes 1 file changed, 0 insertions(+), 0 deletions(-) f8c9c62 release-request-762540b1-1728-41bc-a9ce-e977f3e2683f-for-git_nyc-mr2-pixel-monthly-release-3888830 snap-temp-L22300000056915770 ========device/google/marlin-kernel between android-7.1.2_r17..android-7.1.2_r27========= Image.gz-dtb | Bin 18643765 -> 18647444 bytes 1 file changed, 0 insertions(+), 0 deletions(-) 0152d0b Merge cherrypicks of [2310999, 2310925, 2310891, 2311000, 2310892, 2310858, 2310986, 2310963, 2311043, 2310928, 2311044, 2310990, 2311022, 2311023, 2310917, 2310994, 2311024, 2311045, 2310967, 2310995, 2311003, 2311059, 2311025, 2311060, 2310953, 2311061, 2311004, 2311046, 2311005, 2311047, 2311006, 2311079, 2310954, 2311026, 2310896, 2310898, 2310997, 2311062, 2310955, 2311029, 2310998, 2311080, 2311119, 2311030, 2310933, 2311140, 2311063, 2310934, 2311049, 2311050, 2311084, 2311031, 2311145, 2311164] into nyc-mr2-security-c-release ========device/huawei/angler-kernel between android-7.1.2_r17..android-7.1.2_r27========= Image.gz-dtb | Bin 11160087 -> 11157903 bytes 1 file changed, 0 insertions(+), 0 deletions(-) 71e079c release-request-762540b1-1728-41bc-a9ce-e977f3e2683f-for-git_nyc-mr2-pixel-monthly-release-3888830 snap-temp-L22300000056915770 ========device/lge/bullhead-kernel between android-7.1.2_r17..android-7.1.2_r27========= Image.gz-dtb | Bin 10818319 -> 10817210 bytes 1 file changed, 0 insertions(+), 0 deletions(-) 60b1216 release-request-762540b1-1728-41bc-a9ce-e977f3e2683f-for-git_nyc-mr2-pixel-monthly-release-3888830 snap-temp-L22300000056915770 ========platform/external/boringssl between android-7.1.2_r17..android-7.1.2_r27========= src/crypto/asn1/a_d2i_fp.c | 46 +++++++++++++++++++++++++++++++--------------- 1 file changed, 31 insertions(+), 15 deletions(-) 6345487 CVE 2016-2109 fix ========platform/external/dng_sdk between android-7.1.2_r17..android-7.1.2_r27========= source/dng_ifd.cpp | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) 0680ae9 Throw exception on integer overflow in dng_ifd.cpp. ========platform/external/libavc between android-7.1.2_r17..android-7.1.2_r27========= decoder/ih264d_api.c | 9 ++++++--- decoder/ih264d_dpb_mgr.c | 4 +++- decoder/ih264d_parse_headers.c | 6 ++++-- decoder/ih264d_parse_islice.c | 17 ++++++++++++++--- decoder/ih264d_parse_pslice.c | 20 ++++++++++++++------ decoder/ih264d_parse_slice.c | 4 ---- decoder/ih264d_process_bslice.c | 4 ++-- decoder/ih264d_process_intra_mb.c | 12 +++++++++--- decoder/ih264d_utils.c | 1 + 9 files changed, 53 insertions(+), 24 deletions(-) 0e688a9 Decoder: Fix end of bitstream error. ee93b9e Decoder: Fix allocation for Mbaff weight matrix cc5a278 Decoder: Initialize MB info buffer to zero. 600b985 Decoder: Fixed flag u1_top_bottom_decoded. 66edc4f Decoder: Added an error check while parsing PPS. 9f6b024 Fix stack buffer overflow in ih264d_process_intra_mb e285291 Decoder: Fix in reference list initialization. b9d2d0c Decoder: Fixes in accessing mbaff flag in error cases 6629167 Fix in the case of MMCO 3 (long term reference idx). ========platform/external/libgdx between android-7.1.2_r17..android-7.1.2_r27========= gdx/jni/com.badlogic.gdx.graphics.glutils.ETC1.cpp | 29 ++++++++++-- gdx/jni/gdx2d/gdx2d.c | 21 ++++++++- gdx/jni/gdx2d/jpgd.cpp | 51 +++++++++++++++++----- gdx/jni/gdx2d/stb_image.h | 19 +++++++- 4 files changed, 104 insertions(+), 16 deletions(-) 24309a8ec Fix 36385715 heap overflow when loading HDR files 007cbc8fb Fix Pixmap overflow. Bug 36621442 57b37792a Fix series of JPEG vulnerabilities d0952617a Fix 36385715 heap overflow when loading HDR files ========platform/external/libhevc between android-7.1.2_r17..android-7.1.2_r27========= decoder/ihevcd_parse_headers.c | 61 ++++++++++++++++++++++++++++++++++--- decoder/ihevcd_parse_slice_header.c | 10 ++++-- 2 files changed, 63 insertions(+), 8 deletions(-) 59ed59e Fix heap buffer overflow while searching for valid PPS ac09a1b Check for buffer overflow in pps/slice header parsing 00bdddf memset SPS to zero cf76ac5 Fix reallocation for new sps 78c8eaf DO NOT MERGE Handle streams with change in max_dec_buffering/num_reorder_frames without resolution change 0921fd8 Check for cpb cnt in hrd parsing ========platform/external/libmpeg2 between android-7.1.2_r17..android-7.1.2_r27========= decoder/impeg2d_dec_hdr.c | 22 +++++++++++++++++++++- decoder/impeg2d_decoder.c | 28 +++++++++++++++++++++++++--- decoder/impeg2d_pic_proc.c | 26 ++++++++++++++++++++++++++ decoder/impeg2d_pnb_pic.c | 17 +++++++++++++++-- 4 files changed, 87 insertions(+), 6 deletions(-) afaf341 Check Number of Skip MBs 3f8b60c Error Resilience - Check on as_recent_fld[0][1] e684058 Fix Bytes Consumed Issue ========platform/external/skia between android-7.1.2_r17..android-7.1.2_r27========= resources/invalid_images/b34778578.bmp | Bin 0 -> 132 bytes src/codec/SkBmpCodec.cpp | 7 ++++--- tests/CodexTest.cpp | 17 +++++++++++++++++ 3 files changed, 21 insertions(+), 3 deletions(-) 605163806 Set a limit on the size for BMP images DO NOT MERGE ========platform/external/sonivox between android-7.1.2_r17..android-7.1.2_r27========= arm-wt-22k/lib_src/eas_mdls.c | 5 +++++ arm-wt-22k/lib_src/eas_xmf.c | 7 +++++++ 2 files changed, 12 insertions(+) 2461d73 Fix infinite recursion 86783bc Check chunk size ========platform/external/tremolo between android-7.1.2_r17..android-7.1.2_r27========= Android.mk | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) 46094de Always use unsigned char ========platform/frameworks/av between android-7.1.2_r17..android-7.1.2_r27========= media/libstagefright/MPEG4Extractor.cpp | 33 ++++++++++++----------- media/libstagefright/OggExtractor.cpp | 16 ++++++++++- media/libstagefright/codecs/avcenc/SoftAVCEnc.cpp | 12 +++++++++ media/libstagefright/codecs/avcenc/SoftAVCEnc.h | 2 ++ media/libstagefright/omx/OMXNodeInstance.cpp | 18 +++++++++++++ 5 files changed, 64 insertions(+), 17 deletions(-) 7a3abadff Modifying MetaData invalidates previous char* 4023632c2 Fix memory leak in error case 363f29525 Limit ogg packet size 03c585086 Prevent OOB write in soft_avc encoder 8c68a434b Don't allow using or allocating a buffer after the first state transition ========platform/frameworks/base between android-7.1.2_r17..android-7.1.2_r27========= .../view/accessibility/AccessibilityNodeInfo.java | 23 +++++++++++----------- core/java/com/android/internal/os/ZygoteInit.java | 2 +- .../com/android/server/vr/VrManagerService.java | 6 +----- 3 files changed, 14 insertions(+), 17 deletions(-) f7605407d61 ZygoteInit: Remove CAP_SYS_RESOURCE 24c38ee30b4 system_server: add CAP_SYS_PTRACE 80dbaa78958 Fix re-enabling alert window appop after leaving VR mode. c00fac1404b Make a11y node info parceling more robust ========platform/frameworks/native between android-7.1.2_r17..android-7.1.2_r27========= libs/gui/IGraphicBufferProducer.cpp | 9 +++++++++ libs/gui/Surface.cpp | 6 ++++++ libs/ui/Fence.cpp | 2 +- 3 files changed, 16 insertions(+), 1 deletion(-) 0ac696843 libgui: check for invalid slot in attachBuffer 74fd4497b libgui: Check slot received from IGBP in Surface 947031c9d ui: Fix bad size check in Fence::unflatten ========platform/libcore between android-7.1.2_r17..android-7.1.2_r27========= .../libcore/java/net/FtpURLConnectionTest.java | 85 ++++++++++++++++++++++ .../src/main/java/sun/net/ftp/impl/FtpClient.java | 19 ++++- 2 files changed, 100 insertions(+), 4 deletions(-) 3b42d63fe Proper fix for rejecting ftp URL with /r/n. c1486700b Test for rejection of ftp URL with /r/n in userinfo ========platform/packages/apps/Settings between android-7.1.2_r17..android-7.1.2_r27========= src/com/android/settings/ChooseLockGeneric.java | 15 +- .../settings/accounts/ManageAccountsSettings.java | 32 ++- tests/app/Android.mk | 4 +- .../android/settings/ChooseLockGenericTest.java | 235 +++++++++++++++++++++ 4 files changed, 262 insertions(+), 24 deletions(-) 6b20d59132 Fix phishing attack in ChooseLockGeneric dc744b8d08 resolve merge conflicts of 3964c51bf2 to nyc-dev ========platform/packages/providers/DownloadProvider between android-7.1.2_r17..android-7.1.2_r27========= .../providers/downloads/DownloadProvider.java | 55 ++++++++++++++++++---- 1 file changed, 45 insertions(+), 10 deletions(-) ffaa5eb DO NOT MERGE Deleting downloads for removed uids on downloadprovider start ========platform/packages/providers/MediaProvider between android-7.1.2_r17..android-7.1.2_r27========= src/com/android/providers/media/MediaProvider.java | 43 +++++++++++++++++++++- 1 file changed, 42 insertions(+), 1 deletion(-) 2fb4a84 [DO NOT MERGE] Enforce user separation on external storage ========platform/system/sepolicy between android-7.1.2_r17..android-7.1.2_r27========= system_server.te | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-) a5bb25939 system_server: replace sys_resource with sys_ptrace